Cyber insurance has quietly become the most powerful forcing function in SMB security. Your underwriter, not your CISO, now decides which controls you must have — and they decide at renewal time, on a deadline, with real money on the line. If you can’t produce evidence, you get denied or premium-loaded.
The stakes are not hypothetical:
- 41% of SMB cyber-insurance applications are denied on first submission. (Coalition 2026)
- 73% of SMBs fail their cyber-insurance assessment. (Coalition 2026)
- The top two cited refusal reasons are missing MFA and inadequate endpoint protection (EDR).
Here’s the checklist carriers actually use — and what evidence to have ready.
The eight control families carriers check
Every major SMB carrier (Coalition, Travelers, Chubb, At-Bay, Cowbell, Hiscox, and others) uses some variant of these eight control families. A “Yes” on six of eight is the typical renewal floor; below five usually means denial or a 20–40% premium load.
- MFA enforcement — on all admin accounts, remote access, email, and critical SaaS. Evidence: a per-user MFA-coverage report with the gap list named.
- Endpoint protection (EDR, not just AV) — coverage percentage across Mac, Windows, and Linux. Evidence: an endpoint inventory showing total vs. covered vs. stale agents.
- Email security beyond the M365/Workspace default — BEC detection, phishing protection. Evidence: a last-90-day blocked/quarantined report.
- Privileged access management — separate admin accounts, no shared service accounts. Evidence: a privileged-account inventory with last-used timestamps.
- Identity threat detection — impossible-travel and MFA-fatigue detection. Evidence: an ITDR event log and breach-exposure report by user.
- Backup + tested recovery — 3-2-1 backups, an immutable copy, a restore tested in the last 12 months. Evidence: a backup-coverage audit with last-tested-restore date.
- Incident response plan — written, tested, with named roles. Evidence: an IR playbook library and an auditable incident log.
- Logging + monitoring — ≥90 days of retention with alerting. Evidence: log-retention proof and a correlated-incident report.
Why this is getting harder, not easier
Carriers are tightening because the losses are real. BEC and funds-transfer fraud account for 58% of all claims (Coalition 2026), and the average sub-500-employee breach now costs $3.31M — the only company-size band whose breach cost rose in 2025 (IBM Cost of a Data Breach 2025). Underwriters are pricing that in.
Two controls carriers will ask about next
Coalition and Sophos data suggest two more questions are coming to the questionnaire by 2027:
- Leaked-credential (dark-web) exposure monitoring per user — credential reuse is a top-three initial-access vector, and Microsoft only ships this in Entra ID P2 (~$9/user/month).
- Explainable AI security analysis — as carriers begin awarding discounts for demonstrable AI defense.
Get ahead of both now and your next two renewals get easier.
Where Centeye helps
Centeye doesn’t certify anything for an insurer, but it does run several of these controls every day. Gatewatch watches sign-ins and MFA, Ironwatch covers endpoints, Lighthouse quarantines phishing, and Praxis keeps a record of every step taken, which is the evidence most questionnaires ask you to describe.
To close the identity and email gaps carriers ask about, work through the Microsoft 365 security checklist.
For MSPs, see how an MSP runs 24/7 security without a 24/7 team.
Want to see what Centeye would find on your own tenant? Start a free trial or book an intro call.
Figures cited from industry cyber-insurance surveys (2025), the Coalition 2026 Cyber Claims Report, and the IBM Cost of a Data Breach Report 2025. This article is informational and is not insurance advice; always work with a licensed broker.